Chargebacks & Fraud

Attackers Used UpdraftCentral Connections to Plant Hidden Plugins on WordPress Sites

TeamUpdraft says attackers who reached teamupdraft.com on October 17 and 18 used UpdraftCentral connections to add administrator accounts and hidden plugins to WordPress sites, and that disconnecting a site does not remove what was installed.

E-commerce 4 Internet Marketers Editorial

Older man in a vest tags a large ring of keys at a wooden desk as a woman in a mustard sweater checks off a pinned list.
An older man labels a heavy ring of keys while a colleague checks off a long list beside sketches of buildings, the same key-by-key accounting UpdraftCentral users now face across their sites.

Attackers who got into the teamupdraft.com website during the weekend of October 17 and 18 used UpdraftCentral connections to create administrator accounts and install malicious plugins on customers’ WordPress sites, according to TeamUpdraft, the company behind the UpdraftPlus backup plugin. Some of those plugins can hide from the WordPress Plugins screen and hide the accounts they create. On October 29 the company said a few sites that showed no sign of trouble had been compromised anyway, and that a leftover plugin later created a new administrator after the site had already been disconnected.

For WooCommerce stores, the update that cut off the attackers does not remove anything they left behind. TeamUpdraft now asks owners to check every site that has ever been connected to UpdraftCentral Cloud, on the free or Premium version of UpdraftPlus, including sites where nothing looks wrong.

What TeamUpdraft says was taken

The company’s incident page, first posted October 19 by Joe Whittaker and last updated October 29, says it believes its customer database was accessed. That database holds names, email addresses, billing addresses and order history; account passwords stored in hashed form; two-factor authentication settings; and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.

TeamUpdraft says it stores no card details, because Stripe and PayPal handle its payments. It also says the UpdraftPlus plugin and its downloads were not affected, backups in a customer’s own remote storage such as Google Drive, Dropbox or Amazon S3 were not affected, and self-hosted UpdraftCentral is not affected.

UpdraftCentral is the service that lets one dashboard send commands to many WordPress sites, which is why its keys mattered. TeamUpdraft says the attacker used a compromised key to get into its own site and then used the connections to customer sites to add admin accounts and plugins. The company has reported the incident to the UK’s Information Commissioner’s Office (ICO) and the police, brought in an outside security firm, and said the speed of the follow-on attacks, along with backdoor plugins that were faulty at first, suggests the attackers used AI tools.

The UpdraftPlus update and its limits

UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), released just after 10 p.m. British Summer Time (BST) on October 19, automatically disconnect every UpdraftCentral connection made before 13:07 BST on October 18. WordPress.org pushed the update to all sites. TeamUpdraft also disconnected every site from UpdraftVault, issued new credentials, and replaced every UpdraftClone client key.

The company is explicit that this is not a cleanup. Disconnecting a site stops access through UpdraftCentral, its page says, “but it does not remove anything already installed on your site.” Removing a site from the UpdraftCentral dashboard is not enough either.

Plugin names and accounts to look for

TeamUpdraft lists plugin names tied to the attack, while warning that the list is not complete and that an unfamiliar name is not proof of malware:

  • Site Health Cache
  • Asset Forge 2
  • Core Smith
  • Data Engine Cc0
  • Image Forge
  • Quick Pack
  • Seo Helper
  • WP Forge

Because the plugins can hide, the company tells owners to inspect wp-content/plugins/ and wp-content/mu-plugins/ directly over SFTP, SSH or the host’s file manager. It also gives a text string found in malicious plugin files, “Small maintenance toolkit: keeps option storage tidy.”, which can be searched with grep -r. Not finding it, TeamUpdraft says, does not mean the site is clean.

On accounts, the company said on October 22 that it was seeing a pattern of unexpected users with the editor role. Its page gives randomly generated names such as data-ops43 and media-staff96 as examples, and asks owners to check the database for unexpected entries containing _sync_token.

Cleanup steps TeamUpdraft recommends

The company’s instructions run in a set order, and several steps avoid the WordPress dashboard on purpose:

  • Log in to each site directly, update UpdraftPlus, and delete all keys under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral > Manage existing keys, or run wp option delete updraft_central_localkeys.
  • Do not delete suspicious plugins from the dashboard, because some contain code designed to remove evidence when deleted that way. Deactivate them and remove the folder over SFTP or SSH.
  • List privileged users without loading plugins, using wp user list --role=administrator --skip-plugins and the same command with --role=editor.
  • Run wp config shuffle-salts to end existing login sessions, then change passwords for legitimate administrator and editor accounts.
  • Reset UpdraftVault or remote storage credentials that were connected through UpdraftCentral.
  • If anything suspicious turns up, consider restoring from a backup taken before October 17.

TeamUpdraft’s update of October 21 asked UpdraftPlus Premium users to check their sites even if they had never used UpdraftCentral.

Why a hidden plugin is a payments problem

TeamUpdraft has not said what the malicious plugins were built to do beyond creating accounts and hiding. On a WooCommerce store, though, any plugin runs with the same access to checkout pages, order data and payment gateway settings as the store’s own extensions. A hidden plugin that survives the disconnection is the kind of foothold card skimmers have used on other online stores, and a store whose checkout leaks card numbers can end up facing chargebacks and questions from its processor.

Stores that hold their own copies of payment page files can compare them against known good versions, an approach covered in EC4IM’s guide to file integrity monitoring for WooCommerce payment pages. The same breach is also a reminder to review which third-party services hold keys that can command a store, a topic in the plugin and app vetting checklist.

The state of the UpdraftCentral cleanup

TeamUpdraft believes customer records and the keys behind UpdraftCentral, UpdraftVault and UpdraftClone were exposed in the October 17 and 18 intrusion, and attackers used those connections to plant accounts and plugins on WordPress sites. UpdraftPlus 1.26.13 and 2.26.13 closed that route, but the October 29 update showed that plugins already installed can keep working afterward. Every site ever linked to UpdraftCentral Cloud needs a file level check of its plugin folders, a user list pulled without plugins loaded, new salts and passwords, and possibly a restore from before October 17.

Sources